Chinese hackers target ManageEngine password manager

Around nine organizations in the technology, defense, health care, energy, and education industries hit in new campaign

Security researchers have warned of a new Chinese hacking campaign using a known flaw in the Zoho ManageEngine ADSelfService Plus password manager to steal data.

Hackers gained initial access to targeted organizations by exploiting a recently patched vulnerability in Zoho’s ManageEngine product, ADSelfService Plus, tracked in CVE-2021-40539, according to researchers at Palo Alto Network’s Unit 42.

Researchers added this campaign is separate from one described in a US Cybersecurity and Infrastructure Security Agency (CISA) advisory published in September.

The flaw, CVE-2021-40539, allows for REST API authentication bypass with resultant remote code execution in vulnerable devices. The Zoho patched the flaw   in September.

In this campaign, hackers used leased infrastructure in the US to scan hundreds of vulnerable organizations across the internet. Researchers said exploitation attempts began on September 22 and continued into early October. During that window, the actor successfully compromised at least nine global entities in the technology, defense, health care, energy, and education industries.

After the initial exploitation, a payload was uploaded to the victim network which installed a Godzilla webshell. 

“This activity was consistent across all victims; however, we also observed a smaller subset of compromised organizations who subsequently received a modified version of a new backdoor called NGLite,” said researchers.

Related Resource

The best defence against ransomware

How ransomware is evolving and how to defend against it

Blue padlock Free download

Hackers then used either the webshell or the NGLite payload to run commands and move laterally to other systems on the network while they exfiltrated files of interest simply by downloading them from the web server. 

“Once the actors pivoted to a domain controller, they installed a new credential-stealing tool that we track as KdcSponge,” said researchers.

Researchers said Godzilla and NGLite were developed with Chinese instructions and are publicly available for download on GitHub. 

“We believe threat actors deployed these tools in combination as a form of redundancy to maintain access to high-interest networks,” researchers added.

Researchers said the hackers' main goal was to gain persistent access to the network and gather and exfiltrate sensitive documents from the compromised organization.

“The threat actor gathered sensitive files to a staging directory and created password-protected multi-volume RAR archives in the Recycler folder. The actor exfiltrated the files by directly downloading the individual RAR archives from externally facing web servers,” researchers added.

Featured Resources

Shining light on new 'cool' cloud technologies and their drawbacks

IONOS Cloud Up! Summit, Cloud Technology Session with Russell Barley

Watch now

Build mobile and web apps faster

Three proven tips to accelerate modern app development

Free download

Reduce the carbon footprint of IT operations up to 88%

A carbon reduction opportunity

Free Download

Comparing serverless and server-based technologies

Determining the total cost of ownership

Free download

Recommended

More than 90% of IT decision makers reuse passwords
Security

More than 90% of IT decision makers reuse passwords

30 Nov 2021
Sophos Intercept X Advanced review: AI-powered protection
endpoint security

Sophos Intercept X Advanced review: AI-powered protection

30 Nov 2021
SMBs urged to update software ahead of Black Friday
e commerce

SMBs urged to update software ahead of Black Friday

25 Nov 2021
US adds dozen Chinese tech companies to trade blacklist
Policy & legislation

US adds dozen Chinese tech companies to trade blacklist

25 Nov 2021

Most Popular

What should you really be asking about your remote access software?
Sponsored

What should you really be asking about your remote access software?

17 Nov 2021
Jack Dorsey resigns as Twitter CEO
business management

Jack Dorsey resigns as Twitter CEO

29 Nov 2021
Nike to take customers into the metaverse with 'NIKELAND'
virtualisation

Nike to take customers into the metaverse with 'NIKELAND'

19 Nov 2021